Prevent gem pushes to RubyGems

Question

NPM has the ability to prevent a gem from being published. Is there a way to do the same thing and prevent a gem from being accidentally published to rubygems?

Answer 1

RubyGems 2.2.0 was only recently released, which adds support for this. You need to set allowed_push_host to your own gem server. The documentation describes it thus:

If you want to control who can install a gem, or directly track the activity surrounding a gem, then you’ll want to set up a private gem server. You can set up your own gem server or use a commercial service such as Gemfury.

RubyGems 2.2.0 and newer support the allowed_push_host metadata value to restrict gem pushes to a single host. If you are publishing private gems you should set this value to prevent accidental pushes to rubygems.org:

Gem::Specification.new 'my_gem', '1.0' do |s|
  # ...
  s.metadata['allowed_push_host'] = 'https://gems.my-company.example'
end

To upgrade RubyGems, just run the following command:

gem update --system